Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 80 of 125

  • 9.8 /10 Critical
    CVE-2026-82967 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains an authentication bypass caused by improper IP-based access control validation, letting unauthenticated remote attackers access the management interface, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-82832 Auth required

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote authenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-82340

    IBM Guardium Data Protection - Insecure Deserialization

    IBM Guardium Data Protection 12.2 contains an insecure deserialization vulnerability caused by attacker-controlled reflective method dispatch in the Change Audit System listener, letting network attackers execute code remotely, exploit requires network access to TCP port 16017.

  • 9.8 /10 Critical
    CVE-2026-81657 No auth

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-81321

    CM2507 IP cameras - Information Disclosure

    CM2507 IP cameras contain an information disclosure vulnerability caused by storing wireless network credentials in cleartext within the device filesystem, letting attackers with filesystem access recover network identifiers and keys, exploit requires physical or debugging interface access.

  • 9.9 /10 Critical
    CVE-2026-80442 Auth required

    IBM Guardium Data Protection - Command Injection

    IBM Guardium Data Protection 12.2 contains an authenticated command injection caused by improper input handling in exportCertificate functionality, letting authenticated attackers execute unauthorized OS commands.

  • 9.8 /10 Critical
    CVE-2026-80441 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a second-order SQL injection caused by improper sanitization in generateInsertQuery functionality of change-tracker-data.sql, letting remote attackers compromise confidentiality, integrity, and availability, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-77240 Auth required

    WACRM - Broken Access Control & Information Disclosure

    WACRM <= 0.7.0 contains broken access control caused by improper row-level security policies and SECURITY DEFINER functions, letting authenticated users escalate privileges or access other tenants' data, exploit requires authentication.

  • 9.3 /10 Critical
    CVE-2026-75885 No auth

    OpenShift Console - Server-Side Request Forgery & Denial of Service

    OpenShift console contains a server-side request forgery and denial of service caused by unauthenticated access to /api/devfile/ endpoints allowing crafted payloads and large repeated requests, letting remote attackers cause SSRF and DoS, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-75878 No auth

    IBM Sterling File Gateway - Authentication Bypass

    IBM Sterling File Gateway contains an authentication bypass caused by improper validation of SSO header, letting remote attackers obtain fully authenticated sessions, exploit requires crafted SSO header.

  • 9.8 /10 Critical
    CVE-2026-75031

    Interchange - Remote Code Execution

    Interchange contains a remote code execution caused by arbitrary Perl code injection in the "quick question" admin feature, letting unauthenticated attackers execute code server-side, exploit requires AllowGlobal directive enabled.

  • 10.0 /10 Critical
    CVE-2026-69843 No auth

    Microsoft Fabric - Authentication Bypass

    Microsoft Fabric contains an authentication bypass caused by spoofing, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-67101 No auth

    HCL BigFix Service Management - Server-Side Request Forgery

    HCL BigFix Service Management contains a server-side request forgery caused by improper validation in search functionality, letting attackers force the server to send requests to internal systems, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-67100 No auth

    HCL BigFix Service Management - SQL Injection & Broken Access Control

    HCL BigFix Service Management contains an SQL Injection and Cross-Tenant Data Exposure caused by improper input validation and request handling, letting authenticated attackers extract sensitive data and access personal profiles across tenants, exploit requires authentication.

  • 10.0 /10 Critical
    CVE-2026-62874 No auth

    Azure Billing - Broken Access Control

    Azure Billing contains a broken access control vulnerability caused by insufficient verification of data authenticity, letting unauthorized attackers elevate privileges over a network, exploit requires network access.